WARNING in sta_info_insert_rcu

Status: fixed on 2023/10/05 17:16
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+cba0825e014e1e384a1e@syzkaller.appspotmail.com
Fix commit: 676a42341013 wifi: cfg80211: reject auth/assoc to AP with our address
First crash: 1077d, last: 1077d
Fix bisection: fixed by (bisect log) :
commit 676a423410131d111a264d29aecbe6aadd57fb22
Author: Johannes Berg <johannes.berg@intel.com>
Date: Tue Aug 15 16:09:00 2023 +0000

  wifi: cfg80211: reject auth/assoc to AP with our address

  
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2023/08/13 upstream (ToT) a785fd28d31f C [report] WARNING in sta_info_insert_rcu
2023/09/27 upstream (ToT) 0e945134b680 C Didn't crash
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING in sta_info_insert_rcu -1 C 1648 1236d 2129d 0/1 upstream: reported C repro on 2020/09/24 11:41
linux-5.15 WARNING in sta_info_insert_rcu missing-backport origin:lts-only -1 C inconclusive 7 46d 1089d 0/3 upstream: reported C repro on 2023/07/31 21:20
upstream WARNING in sta_info_insert_rcu (3) wireless -1 C done 6 1064d 1105d 23/29 fixed on 2023/10/12 12:48
linux-4.14 WARNING in sta_info_insert_rcu -1 C 13 1252d 2126d 0/1 upstream: reported C repro on 2020/09/27 22:10
upstream WARNING in sta_info_insert_rcu (2) wireless -1 1 1485d 1481d 0/29 auto-obsoleted due to no activity on 2022/10/28 19:30
upstream WARNING in sta_info_insert_rcu (4) wireless -1 C 27 401d 613d 29/29 fixed on 2025/08/06 17:37
upstream WARNING in sta_info_insert_rcu -1 C done done 2533 1693d 2130d 20/29 fixed on 2022/03/08 16:11

Sample crash report:
wlan1: authenticate with 08:02:11:00:00:01
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1510 at net/mac80211/sta_info.c:726 sta_info_insert_rcu+0x220/0x144c net/mac80211/sta_info.c:917
Modules linked in:
CPU: 1 PID: 1510 Comm: kworker/1:2 Not tainted 6.1.45-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Workqueue: events cfg80211_conn_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sta_info_insert_rcu+0x220/0x144c net/mac80211/sta_info.c:917
lr : sta_info_insert_check net/mac80211/sta_info.c:725 [inline]
lr : sta_info_insert_rcu+0x21c/0x144c net/mac80211/sta_info.c:917
sp : ffff800021e16de0
x29: ffff800021e170b0 x28: ffff7000043c2dd0 x27: dfff800000000000
x26: 0000000000000000 x25: 00000000ffffffea x24: ffff0000cce4cc80
x23: 0000000000000000 x22: ffff0000da5396c8 x21: ffff0000c4be0048
x20: 0000000000110208 x19: ffff0000c4be0000 x18: ffff800021e16900
x17: ffff800011b1e874 x16: ffff8000084fce08 x15: 000000000000cb3c
x14: 00000000ffffffff x13: dfff800000000000 x12: 0000000000000001
x11: ff80800011997558 x10: 0000000000000000 x9 : ffff800011997558
x8 : ffff0000cea6d340 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff8000082fc258
x2 : ffff0000cea6d340 x1 : 0000000000110308 x0 : 0000000000000000
Call trace:
 sta_info_insert_rcu+0x220/0x144c net/mac80211/sta_info.c:917
 sta_info_insert+0x20/0xcc net/mac80211/sta_info.c:930
 ieee80211_prep_connection+0xc14/0xf34 net/mac80211/mlme.c:6574
 ieee80211_mgd_auth+0x8d0/0xd9c net/mac80211/mlme.c:6732
 ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2785
 rdev_auth net/wireless/rdev-ops.h:469 [inline]
 cfg80211_mlme_auth+0x39c/0x7a0 net/wireless/mlme.c:280
 cfg80211_conn_do_work+0x3b8/0xb84 net/wireless/sme.c:181
 cfg80211_conn_work+0x248/0x428 net/wireless/sme.c:273
 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 114832
hardirqs last  enabled at (114831): [<ffff8000121f7464>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (114831): [<ffff8000121f7464>] _raw_spin_unlock_irqrestore+0x48/0xac kernel/locking/spinlock.c:194
hardirqs last disabled at (114832): [<ffff800012112c3c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (114790): [<ffff800011824f9c>] spin_unlock_bh include/linux/spinlock.h:395 [inline]
softirqs last  enabled at (114790): [<ffff800011824f9c>] cfg80211_get_bss+0x864/0xb34 net/wireless/scan.c:1510
softirqs last disabled at (114788): [<ffff800011824880>] spin_lock_bh include/linux/spinlock.h:355 [inline]
softirqs last disabled at (114788): [<ffff800011824880>] cfg80211_get_bss+0x148/0xb34 net/wireless/scan.c:1484
---[ end trace 0000000000000000 ]---
wlan1: failed to insert STA entry for the AP (error -22)
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1510 at net/mac80211/chan.c:2016 ieee80211_link_release_channel+0x174/0x1a4 net/mac80211/chan.c:2016
Modules linked in:
CPU: 1 PID: 1510 Comm: kworker/1:2 Tainted: G        W          6.1.45-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Workqueue: events cfg80211_conn_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ieee80211_link_release_channel+0x174/0x1a4 net/mac80211/chan.c:2016
lr : ieee80211_link_release_channel+0x174/0x1a4 net/mac80211/chan.c:2016
sp : ffff800021e170f0
x29: ffff800021e170f0 x28: 00000000ffffffea x27: ffff0000cce4e248
x26: ffff0000cce4e688 x25: ffff0000cce4e808 x24: ffff0000c4be0000
x23: 1fffe000199c9ab2 x22: dfff800000000000 x21: 0000000000000000
x20: ffff0000cce4e248 x19: ffff0000cce4d590 x18: ffff800021e16c20
x17: 0000000000000000 x16: ffff8000084fce08 x15: 000000000000cb7d
x14: 00000000ffffffff x13: dfff800000000000 x12: 0000000000000001
x11: ff80800011ab9d0c x10: 0000000000000000 x9 : ffff800011ab9d0c
x8 : ffff0000cea6d340 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff8000082fc258
x2 : ffff0000cea6d340 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 ieee80211_link_release_channel+0x174/0x1a4 net/mac80211/chan.c:2016
 ieee80211_prep_connection+0x280/0xf34 net/mac80211/mlme.c:6592
 ieee80211_mgd_auth+0x8d0/0xd9c net/mac80211/mlme.c:6732
 ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2785
 rdev_auth net/wireless/rdev-ops.h:469 [inline]
 cfg80211_mlme_auth+0x39c/0x7a0 net/wireless/mlme.c:280
 cfg80211_conn_do_work+0x3b8/0xb84 net/wireless/sme.c:181
 cfg80211_conn_work+0x248/0x428 net/wireless/sme.c:273
 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 114932
hardirqs last  enabled at (114931): [<ffff8000083442c4>] __up_console_sem+0xb4/0x100 kernel/printk/printk.c:261
hardirqs last disabled at (114932): [<ffff800012112c3c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (114926): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last  enabled at (114926): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (114917): [<ffff80000802a994>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1510 at net/mac80211/iface.c:113 __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
WARNING: CPU: 1 PID: 1510 at net/mac80211/iface.c:113 ieee80211_recalc_idle+0x2b8/0x340 net/mac80211/iface.c:149
Modules linked in:
CPU: 1 PID: 1510 Comm: kworker/1:2 Tainted: G        W          6.1.45-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Workqueue: events cfg80211_conn_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
pc : ieee80211_recalc_idle+0x2b8/0x340 net/mac80211/iface.c:149
lr : __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
lr : ieee80211_recalc_idle+0x2b8/0x340 net/mac80211/iface.c:149
sp : ffff800021e16f90
x29: ffff800021e16f90 x28: 0000000000000000 x27: ffff0000c0b72800
x26: ffff0000c0b72820 x25: ffff0000c0b72830 x24: dfff800000000000
x23: 000000000000096c x22: 1fffe0001b4a71c7 x21: 0000000000000000
x20: 0000000000000000 x19: ffff0000da538e00 x18: ffff800021e16960
x17: 0000000000000000 x16: ffff8000084fce08 x15: 000000000000cbd0
x14: 00000000ffffffff x13: dfff800000000000 x12: 0000000000000001
x11: ff808000119e96cc x10: 0000000000000000 x9 : ffff8000119e96cc
x8 : ffff0000cea6d340 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff8000121e6514
x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
 ieee80211_recalc_idle+0x2b8/0x340 net/mac80211/iface.c:149
 ieee80211_del_chanctx+0x3ac/0x790 net/mac80211/chan.c:750
 ieee80211_free_chanctx+0x28c/0x354 net/mac80211/chan.c:761
 __ieee80211_link_release_channel+0x3f4/0x57c net/mac80211/chan.c:1800
 ieee80211_link_release_channel+0x138/0x1a4 net/mac80211/chan.c:2017
 ieee80211_prep_connection+0x280/0xf34 net/mac80211/mlme.c:6592
 ieee80211_mgd_auth+0x8d0/0xd9c net/mac80211/mlme.c:6732
 ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2785
 rdev_auth net/wireless/rdev-ops.h:469 [inline]
 cfg80211_mlme_auth+0x39c/0x7a0 net/wireless/mlme.c:280
 cfg80211_conn_do_work+0x3b8/0xb84 net/wireless/sme.c:181
 cfg80211_conn_work+0x248/0x428 net/wireless/sme.c:273
 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 115014
hardirqs last  enabled at (115013): [<ffff800012115050>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (115013): [<ffff800012115050>] exit_to_kernel_mode+0xe8/0x118 arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (115014): [<ffff800012112c3c>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (115012): [<ffff800008020d74>] softirq_handle_end kernel/softirq.c:414 [inline]
softirqs last  enabled at (115012): [<ffff800008020d74>] __do_softirq+0xc14/0xea0 kernel/softirq.c:600
softirqs last disabled at (114935): [<ffff80000802a994>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/08/13 09:36 linux-6.1.y 1321ab403b38 39990d51 .config console log report syz C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 WARNING in sta_info_insert_rcu
* Struck through repros no longer work on HEAD.